1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <android-base/logging.h>
18 #include <fuzzer/FuzzedDataProvider.h>
19 #include <gmock/gmock.h>
20 #include "ClientConfig.pb.h"
21 #include "Common.h"
22 #include "LocalPrebuiltGraph.h"
23 #include "PrebuiltEngineInterfaceImpl.h"
24
25 using ::android::automotive::computepipe::runner::ClientConfig;
26
27 namespace android {
28 namespace automotive {
29 namespace computepipe {
30 namespace graph {
31
32 namespace {
33
34 enum LOCAL_PREBUILD_GRAPH_FUZZ_FUNCS { GRAPH_RUNNER_BASE_ENUM, RUNNER_COMP_BASE_ENUM };
35
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)36 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
37 // Initialization goes here
38 bool graphHasTerminated = false;
39 int numOutputStreamCallbacksReceived[4] = {0, 0, 0, 0};
40
41 PrebuiltEngineInterfaceImpl callback;
42 callback.SetGraphTerminationCallback(
43 [&graphHasTerminated](Status, std::string) { graphHasTerminated = true; });
44
45 // Add multiple pixel stream callback functions to see if all of them register.
46 callback.SetPixelCallback([&numOutputStreamCallbacksReceived](int streamIndex, int64_t,
47 const runner::InputFrame&) {
48 ASSERT_TRUE(streamIndex == 0 || streamIndex == 1);
49 numOutputStreamCallbacksReceived[streamIndex]++;
50 });
51
52 // Add multiple stream callback functions to see if all of them register.
53 callback.SetSerializedStreamCallback(
54 [&numOutputStreamCallbacksReceived](int streamIndex, int64_t, std::string&&) {
55 ASSERT_TRUE(streamIndex == 2 || streamIndex == 3);
56 numOutputStreamCallbacksReceived[streamIndex]++;
57 });
58
59 std::shared_ptr<PrebuiltEngineInterface> engineInterface =
60 std::static_pointer_cast<PrebuiltEngineInterface, PrebuiltEngineInterfaceImpl>(
61 std::make_shared<PrebuiltEngineInterfaceImpl>(callback));
62 PrebuiltGraph* graph = GetLocalGraphFromLibrary("libstubgraphimpl.so", engineInterface);
63
64 // Fuzz goes here
65 FuzzedDataProvider fdp(data, size);
66 while (fdp.remaining_bytes() > runner::test::kMaxFuzzerConsumedBytes) {
67 switch (fdp.ConsumeIntegralInRange<uint32_t>(0, API_SUM - 1)) {
68 case GET_GRAPH_TYPE: {
69 graph->GetGraphType();
70 break;
71 }
72 case GET_GRAPH_STATE: {
73 graph->GetGraphState();
74 break;
75 }
76 case GET_STATUS: {
77 graph->GetStatus();
78 break;
79 }
80 case GET_ERROR_MESSAGE: {
81 graph->GetErrorMessage();
82 break;
83 }
84 case GET_SUPPORTED_GRAPH_CONFIGS: {
85 graph->GetSupportedGraphConfigs();
86 break;
87 }
88 case SET_INPUT_STREAM_DATA: {
89 graph->SetInputStreamData(/*streamIndex =*/2, /* timestamp =*/0, /* data =*/"");
90 break;
91 }
92 case SET_INPUT_STREAM_PIXEL_DATA: {
93 runner::InputFrame inputFrame(0, 0, PixelFormat::RGB, 0, nullptr);
94 graph->SetInputStreamPixelData(/*streamIndex =*/1, /*timestamp =*/0,
95 /*inputFrame =*/inputFrame);
96 break;
97 }
98 case START_GRAPH_PROFILING: {
99 graph->StartGraphProfiling();
100 break;
101 }
102 case STOP_GRAPH_PROFILING: {
103 graph->StopGraphProfiling();
104 break;
105 }
106 case HANDLE_CONFIG_PHASE: {
107 std::map<int, int> maxOutputPacketsPerStream;
108 ClientConfig e(0, 0, 0, maxOutputPacketsPerStream, proto::ProfilingType::DISABLED);
109 e.setPhaseState(runner::PhaseState::ENTRY);
110 graph->handleConfigPhase(e);
111 break;
112 }
113 case HANDLE_EXECUTION_PHASE: {
114 std::map<int, int> maxOutputPacketsPerStream;
115 ClientConfig e(0, 0, 0, maxOutputPacketsPerStream, proto::ProfilingType::DISABLED);
116 e.setPhaseState(runner::PhaseState::ENTRY);
117 graph->handleExecutionPhase(e);
118 break;
119 }
120 case HANDLE_STOP_IMMEDIATE_PHASE: {
121 std::map<int, int> maxOutputPacketsPerStream;
122 ClientConfig e(0, 0, 0, maxOutputPacketsPerStream, proto::ProfilingType::DISABLED);
123 e.setPhaseState(runner::PhaseState::ENTRY);
124 graph->handleStopImmediatePhase(e);
125 break;
126 }
127 case HANDLE_STOP_WITH_FLUSH_PHASE: {
128 std::map<int, int> maxOutputPacketsPerStream;
129 ClientConfig e(0, 0, 0, maxOutputPacketsPerStream, proto::ProfilingType::DISABLED);
130 e.setPhaseState(runner::PhaseState::ENTRY);
131 graph->handleStopWithFlushPhase(e);
132 break;
133 }
134 case HANDLE_RESET_PHASE: {
135 std::map<int, int> maxOutputPacketsPerStream;
136 ClientConfig e(0, 0, 0, maxOutputPacketsPerStream, proto::ProfilingType::DISABLED);
137 e.setPhaseState(runner::PhaseState::ENTRY);
138 graph->handleResetPhase(e);
139 break;
140 }
141 default:
142 LOG(ERROR) << "Unexpected option aborting...";
143 break;
144 }
145 }
146 return 0;
147 }
148
149 } // namespace
150 } // namespace graph
151 } // namespace computepipe
152 } // namespace automotive
153 } // namespace android
154